A10 Networks
A10 Networks normalizes A10 Networks events from A10 Thunder devices and A10 Web Application Firewall and enables you to analyze A10 Networks data using reports and pre-set dashboard views. You can further customize the dashboard, report, and searches to perform an in-depth analysis.
Package Details
A10 Networks consists of the following components:
-
-
Dashboard Package
- LP_A10 Thunder
-
Report Package
- LP_A10 Thunder
-
Normalization Package
- LP_A10 Web Application Firewall
- LP_A10 Web Application Firewall CEF
-
Compiled Normalizer
- A10WAFCompiledNormalizer
-
Dashboard Package
Enhancement
| Description | Issue ID | Reference ID |
|---|---|---|
| Added Syslog Collector based A10 Networks log source template, simplifying the log source configuration process. To learn more, go to Creating Log Source via a Template. | KB-22855 | - |
Installation
To install A10 Networks:
- Download the .pak file from the Download link above.
- Go to Settings >> System Settings from the navigation bar and click Applications.
- Click Import.
- Browse to the downloaded .pak file.
- Click Upload.
Past Releases
A10 Networks v5.0.2
Enhancement
A10WAFCompiledNormalizer has been enhanced for better normalization of the A10Networks logs.
A10 Networks v5.0.1
Enhancement
A minor update has been done in the A10 Network's normalizer for better signature handling.
A10 Networks v3.2.0
Enhancement
A minor update has been done in the A10 Network's normalizer for better signature handling.
Screenshot
Supported Devices
The supported versions of A10 Networks with LogPoint in this configuration are:
- A10 Thunder Server 2.7.2
- A10 Thunder Series and AX Series
Log Formats
Expected Log Format
Syslog
Log Sample
Nov 26 2014 14:47:42Notice [SYSTEM]A cli session for user "xyz" from 1.1.1.1:49436 has been opened. Session ID assigned is x. Nov 26 2014 14:53:27Notice [SYSTEM]A web session for user "xyz" from 1.1.1.1:49989 has been opened. Session ID assigned is x.
Expected Log Format
CEF
Log Sample
Mar 12 16:34:08 1.1.1.1 CEF:1|A10|vThunder|2.7.2-P4|WAF|Mar 12 2015 16:25:42|sqlia-check|6|src=1.1.1.1 spt=56086 dst=1.1.1.1 dpt=1 hst="1.1.1.1" cs1=TEST cs2=1c7dc896da46724a act=deny md=active svc=https req="POST /mutillidae/index.php?page=login.php HTTP/1.1" 71 msg="SQLIA pattern detected! %22%27+or+1%3d1+--+%22 matches #1 in rule1"
To export data to LogPoint, use Syslog collector on port 514 on the LogPoint server.
Support
If you have any questions or require assistance, create a support ticket.
Comments
Article is closed for comments.